← All certifications

EC-Council Certified Incident Handler (ECIH)

EC-Council

EC-Council's incident handling and response certification covering the IH&R process across malware, email, network, web app, cloud, insider, and endpoint incidents.

We have a course for this

Built from this exam's published objectives. The first module is free.

What this qualifies you for

Listed specifically for 1 work role — up to Intermediate proficiency. Because options cascade downward, a cert listed at Advanced also satisfies Intermediate and Basic for that role.

Also listed for 14 Cyberspace Enablers roles — but so is every other certification

The Enablers matrix isn’t role-differentiated: the same certification options are listed for all 14 roles at every proficiency level. We verified that across all 14. So this is true, and it carries no information about this credential specifically — which is why it isn’t in the count above.

Renewal

3year cycle120ECE credit per cycle

USD $80 annual EC-Council Continuing Education (CE) membership fee (approx. $240 over the 3-year cycle), in addition to submitting 120 ECE credits

This is the issuer’s clock. 8140 runs a second one — 20 hours of CPD a year, at every proficiency level, which applies even if you hold no certification at all. How that works

EC-Council publishes the 10 modules/objective areas without percentage weights on the official course page; all domains are recorded as weight 0 (unweighted). The official course page did not state a passing score; EC-Council uses multiple exam forms with a per-form cut score. Third-party sources cite ~70%, but this is not confirmed on the official page. Version 'v3' (exam code 212-89) is the current form per the official course page and EDUSUM references.

Source: EC-Council - EC-Council Certified Incident Handler (ECIH) · dated 2026-07-17 · checked 2026-07-17

Verifying it

EC-Council publishes a lookup a third party can use without your involvement.

Candidate Name and Certification Number

EC-Council publishes the 10 modules/objective areas without percentage weights on the official course page; all domains are recorded as weight 0 (unweighted). The official course page did not state a passing score; EC-Council uses multiple exam forms with a per-form cut score. Third-party sources cite ~70%, but this is not confirmed on the official page. Version 'v3' (exam code 212-89) is the current form per the official course page and EDUSUM references.

Source: EC-Council - EC-Council Certified Incident Handler (ECIH) · dated 2026-07-17 · checked 2026-07-17

Exam blueprint

Verified against EC-Council’s published outline.

212-89 · v3

Current

100 questions · 3 hours · passing score varies (cut score set per exam form; commonly cited ~70%)

Introduction to Incident Handling and Response
Incident Handling and Response Process
First Response
Handling and Responding to Malware Incidents
Handling and Responding to Email Security Incidents
Handling and Responding to Network Security Incidents
Handling and Responding to Web Application Security Incidents
Handling and Responding to Cloud Security Incidents
Handling and Responding to Insider Threats
Handling and Responding to Endpoint Security Incidents

EC-Council publishes objective areas without percentage weightings, so none are shown.

EC-Council publishes the 10 modules/objective areas without percentage weights on the official course page; all domains are recorded as weight 0 (unweighted). The official course page did not state a passing score; EC-Council uses multiple exam forms with a per-form cut score. Third-party sources cite ~70%, but this is not confirmed on the official page. Version 'v3' (exam code 212-89) is the current form per the official course page and EDUSUM references.

Source: EC-Council - EC-Council Certified Incident Handler (ECIH) · dated 2026-07-17 · checked 2026-07-17